You work as a Network Administrator for NetTech Inc. The company has a network that consists of 200 client computers and ten database servers. One morning, you find that an unauthorized user is…

Restricting unauthorized company employees from the server room prevents tampering with physical evidence and maintains the integrity of the incident scene, which is a foundational step in evidence preservation.

Detaching the network cable from the database server immediately stops ongoing unauthorized access and preserves the current system state, preventing further data exfiltration or evidence destruction by the attacker.

Preventing forensics experts from entering the server room directly obstructs the investigation - forensics teams must be granted access to properly collect, document, and analyze evidence from the compromised server.

Preserving log files is critical digital evidence collection - logs contain records of the unauthorized user's actions, timestamps, and access patterns that a forensics expert needs for attribution and analysis.